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AUDITOR’S LETTER 


The objective of the audit was to review the Denver Public Trustee in the Clerk and Recorder's Office— 
including accounting practices, compliance with laws and regulations, and governance structure— 
and to evaluate the efficiency and effectiveness of the Denver Public Trustee’s internal controls over 
financial reporting and over the foreclosure process. | am pleased to present the results of this audit. 


The audit revealed the Denver Public Trustee needs to significantly improve segregation of duties 
and internal controls over financial reporting, cash receipts, cash disbursements, reconciliations, and 
information systems. In addition, the Denver Public Trustee needs to formalize written policies and 
procedures related to its accounting functions. 


Our assessment of the Denver Public Trustee's systems indicates there is a significant weakness in 
internal controls affecting the agency. Through the design and implementation of stronger policies 
and segregation of duties, the Denver Public Trustee will be able to better mitigate the risk of mistakes 
and errors, improve the accuracy of its financial reporting, and provide greater transparency for 

the amount of financial transactions processed on behalf of others. Our report lists several related 
recommendations. 


This performance audit is authorized pursuant to the City and County of Denver Charter, Article V, Part 
2, Section 1, “General Powers and Duties of Auditor,” and was conducted in accordance with generally 
accepted government auditing standards. Those standards require we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions 
based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 


We extend our appreciation to the Denver Public Trustee personnel who assisted and cooperated with 
us during the audit. For any questions, please feel free to contact me at 720-913-5000. 


Denver Auditor’s Office 
Timothy M. O’Brien, CPA 
Auditor 
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Objective 


The objective of the audit was 

to review the Denver Public 
Trustee—including its accounting 
practices, compliance with laws 
and regulations, and governance 
structure—and to evaluate the 
efficiency and effectiveness of its 
internal controls over the foreclosure 
process. 


Background 


Colorado state law establishes the 
foreclosure process and delegates 
authority to a public trustee within 
each county to oversee that 
process in an objective and fair 
manner. In some counties, the 
public trustee function is performed 
by the county treasurer, while in 
the City and County of Denver, the 
elected Clerk and Recorder serves 
as the public trustee. 


Highlights 
The Denver Public Trustee’s Fund Activity Is Not Clearly Stated in the 
City’s Comprehensive Annual Financial Report 


Agency fund activity in the City’s 2017 comprehensive annual 
financial report was presented based on the net change in assets and 
liabilities, rather than based on the gross activity passing through the 
fund. 


The Denver Public Trustee Has a Significant Weakness in Internal 
Controls 


During the course of our audit, we found numerous control 
deficiencies in the Denver Public Trustee’s accounting function. These 
deficiencies result in a significant weakness in internal control for the 
Denver Public Trustee. These deficiencies relate to: 

e = Insufficient written policies and procedures; 

e An inadequate accounting system; 

e Inaccurate recording of fee revenue; 

e Errors in the list of fees that can be charged; 

e Checks that are improperly printed and held; 

e Improper accounting for held checks; 

e Alack of controls over service organizations; 

e Insufficient segregation of duties; and 


e Poor user permissions and access management policies. 


Payroll Approvals Are Accurate and Timely 


We found that the Denver Public Trustee does approve employee 
time sheets accurately and in a timely manner. 


For a copy of this report, visit www.denverauditor.org 


or contact the Auditor’s Office at (720) 913-5000. 


TABLE OF CONTENTS 


BACKGROUND 


FINDING 1 


The Denver Public Trustee’s Fund Activity Is Not Clearly Stated in the City’s 
Comprehensive Annual Financial Report 


FINDING 2 


The Denver Public Trustee Has a Significant Weakness in Internal Controls 
Key Policies and Procedures Are Insufficient 


The Denver Public Trustee Lacks an Adequate System to Account for Its Financial 
Transactions 


Revenue Is Improperly Allocated in Workday 

Automatically Assessed Fees Are Not Regularly Reviewed 
Checks Are Inappropriately Held 

Held Checks Are Not Properly Treated for Accounting Purposes 


Service Organization Controls Reports 
Are Not Reviewed 


The Denver Public Trustee Has Insufficient Segregation of Duties 


User Access Policies for Critical Information Systems Are Inadequate 


FINDING 3 


Payroll Approvals Are Accurate and Timely 
RECOMMENDATIONS 
AGENCY RESPONSES TO AUDIT RECOMMENDATIONS 
OBJECTIVE, SCOPE, AND METHODOLOGY 


APPENDICES 


Appendix A - Glossary 


40 


42 


BACKGROUND 


Colorado state law establishes the 

foreclosure process and delegates 

authority to a public trustee 

within each county to oversee For definitions of common 

that process in an objective and Hee Tlie tenme vsee 

fair manner. In some counties as epet renga 
Appendix A. 

the county treasurer performs 

the public trustee function, while 

in other counties the governor 

appoints the public trustee. The City and County of Denver is unique 

in that its public trustee functions are performed by the Clerk and 

Recorder.’ 


FOR MORE INFORMATION 


Denver Public Trustee As illustrated in Figure 1, the Denver Public Trustee is the division within 
the Office of the Clerk and Recorder that is charged with performing 
the day-to-day operations to ensure the foreclosure process is handled 
objectively and fairly for all parties. In 2017 and 2018, the Denver Public 


FIGURE 1. Office of the Clerk and Recorder Organization Chart 


Office of the Clerk 
and Recorder 


Clerk and Recorder 


Elections Division Bene 
Division 


Administration Operations Team Recording Denver Public 


Team Department Trustee 
Administration 
Communications Voter Semice; Records and 
Department Management Communications 
Department 

Source: 2019 Mayor's Proposed Budget information. 

Note: The dark blue emphasizes the organizational hierarchy for the Denver Public Trustee. 

1 Colo. Rev. Stat. § 38-37-101. 
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Trustee had an annual operating budget of about $275,000 to cover 
the salaries and benefits of four full-time employees.” 


In recent years, the Denver Public Trustee has handled about 700 new 
foreclosure filings per year. There are multiple conditions under which 
a foreclosure may be initiated. Typically, this occurs when a property 
owner fails to make the required payments to their lender, and the 
lender initiates the foreclosure with the intention of selling the property 
to recover the unpaid debt. 


Foreclosure Process As illustrated in Figure 2 on the following page, to initiate the foreclosure 
process, a lien holder—such as a bank—submits a foreclosure packet 
to the Denver Public Trustee. The foreclosure packet includes evidence 
of debt, an assertion the property owner violated the loan agreement, 
and the notice of election and demand. 


The Denver Public Trustee then takes steps to sell the foreclosed-upon 
property in an auction, which is run by the division using an online tool 
developed and maintained by a vendor, and the division remits the 
funds to valid lien holders in order of priority and, if any funds remain, to 
the former property owner. 


The auction sale is followed by a “redemption” period, which is the 
opportunity for subordinate lien holders, such as the issuer of a line 

of credit, to be made whole before their liens are stripped from the 
property. Once the redemption period ends, the foreclosure is finalized 
and closed. 


Prior to the foreclosure sale, property owners may be able to “cure” the 
condition that led to the foreclosure being initiated, typically by paying 
the outstanding amount in default.’ In order to complete a cure, funds 
necessary to satisfy the debt are paid directly to the Denver Public 
Trustee, which then remits the funds to the lien holder. 


While the Denver Public Trustee never takes ownership of a foreclosed- 
upon property, the division is responsible for collecting and remitting 
funds related to foreclosures. The division collects deposits from 
prospective foreclosure auction bidders, payments from auction 
winners, payments for cures, deposits from lien holders, and other funds, 
such as redemptions. 


2 “The Mayor’s 2019 Budget,” Department of Finance, accessed February 12, 2019, https://www.denvergov.org/content/denvergov/en/ 
denver-department-of-finance/financial-reports/city-budget.html. 


3 “Foreclosure Statistical Information,” Office of the Clerk and Recorder, accessed February 12, 2019, https://www.denvergov.org/content/ 
denvergov/en/denver-office-of-the-clerk-and-recorder/foreclosures/foreclosure-stats.html. 


t Notice of election and demand are forms required by state law. 
5 By curing a foreclosure, the property owners prevent the property from being sold at auction. 
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FIGURE 2. The Standard Foreclosure Process 


FORECLOSURE INITIATED 


A lien holder submits the foreclosure packet—which includes a “notice of election and demand”—to the Denver 


Public Trustee. 


ALL PARTIES NOTIFIED 


The notification process includes public notice of the foreclosure in local media and two “combined notices” 
sent to the parties involved. After the combined notice is provided to the property owner, one of the following 
three outcomes occurs: a) the property owner pays the outstanding amount in default, b) the property is sold at 
auction, or c) the lien holder submits a withdrawal to end the foreclosure. 


OPTION A: 
PROPERTY OWNER PAYS 


OFF THE DEBT 


If the owner wants to pay the 
outstanding amount, they 
must file an “intent to cure” 
form, requesting how much 
is owed. The Denver Public 
Trustee facilitates this as an 
intermediary between the 
property owner and the lien 
holder. 


The property owner then 

pays the public trustee the 
outstanding amount due, and 
the trustee relays that money 
to the lien holder, which stops 
the foreclosure. 


Source: Developed by auditors based on information provided by Denver Public Trustee. 


OPTION B: 
PROPERTY SOLD AT AUCTION 


If the property owner does not 
pay the outstanding amount in 
default, the Denver Public Trustee 
holds a foreclosure auction to 

sell the property to the highest 
bidder. 


REDEMPTION PERIOD BEGINS 


After the auction, the redemption 
period occurs, which affords any 
subordinate lien holder the option 
to buy the foreclosed property 
from the highest bidder at the 
auction sale for the sale amount. 
This gives the subordinate lien 
holder the chance to make 
themselves whole. 


FORECLOSURE CONCLUDES 


The Denver Public Trustee collects 
the money from the auction 

sale and relays it to the valid lien 
holders in order of priority. 


OPTION C: 
LIEN HOLDER WITHDRAWS 


THE FORECLOSURE 


The lien holder files to withdraw 
the foreclosure, without the 
property owner paying off the 
debt and without auctioning 
the property. 


For example, this can happen 
when there is a modification to 
the loan agreement. 


Note: This figure contains a simplified depiction of the foreclosure process. It does not capture the many nuances of individual 


and unique proceedings. 
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The Denver Public Trustee collected $23.7 million through this process 
in 2017. The Denver Public Trustee is responsible for safeguarding these 
funds for the property owners, lien holders, and prospective auction 
bidders. 


The Denver Public Trustee then disburses the proceeds from auction 
sales, cures, and/or redemptions to the relevant lien holders to satisfy 
the outstanding debt. If applicable, remaining funds are disbursed to 
the former property owner. 
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FINDING 1 


The Denver Public Trustee’s Fund Activity Is Not Clearly Stated in the City’s 
Comprehensive Annual Financial Report 


In the City’s comprehensive annual financial report, as prepared by the 
Controller's Office, dated December 31, 2017, the City aggregated alll 
agency funds for financial reporting purposes.’ Agency funds are used 
to account for assets the City holds on behalf of others as their agent. 
These funds are not the property of the City but are temporarily held by 
the City. 


As illustrated in Table 1, the agency fund total asset additions were 
understated by $20.7 million. Likewise, deductions from total assets were 
understated by $20.7 million. Total liability additions were understated 
by $23.6 million, and total liability deductions were also understated 

by $23.6 million. Although additions and deductions for both assets 

and liabilities were understated, the ending balances were correctly 
reported. 


TABLE 1. Understatements of Denver Public Trustee Agency Funds 


Balance on ae : Balance on 


Assets — as originally recorded 2 $2,831,000 $3,001,000 $3,615,000 $2,217,000 
Assets — as corrected © $2,831,000 $23,720,000 $24,334,000 $2,217,000 
ee ees 
Liabilities — as originally recorded? $2,831,000 $170,000 $784,000 $2,217,000 
Liabilities - as corrected® $2,831,000 $23,720,000 $24,334,000 $2,217,000 


Source: Auditor’s Office analysis based on information provided by the Denver Public Trustee. 


Note: ° “As originally recorded” means how additions and deductions for the Denver Public Trustee's agency funds were 
recorded in the City’s 2017 comprehensive annual financial report—which was done using net amounts. This calculation 
understates the true volume of money handled by the Denver Public Trustee in 2017. 


b “As corrected” is based on auditors’ analysis of how the additions and deductions ought to have been recorded—which 
best practices state should be done using gross amounts. This calculation more transparently reports to the public how 
much money the Denver Public Trustee handles annually on behalf of others. 


6€ City and County of Denver, 2017 Comprehensive Annual Financial Report (2017). Accessed February 6, 2019, https://www.denvergov. 
org/content/dam/denvergov/Portals/344/documents/CAFR/Report_CAFR_2017.pdf. 
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By understating assets and liabilities additions and deductions, the 


The Denver Denver Public Trustee’s reporting does not accurately reflect the 
Public Trustee’s actual amount of money flowing through the division. This minimizes the 
reporting does significance of the agency fund. 

not accurately These understatements were because the closing journal entry 


reflect the actual recorded for the Denver Public Trustee agency fund was recorded as 
amount of money the net amount of activity for the year that ended December 31, 2017, 
flowing through rather than recorded as the gross activity amounts of additions and 


ae deductions. 
the division. 


The City’s Fiscal Accountability Rules require each City agency to 
complete a financial disclosure certification, confirming compliance 
with financial reporting requirements and confirming that any activity 
that could impact the City’s financial statements has been reported to 
the Controller's Office.’ 


The accounting standards pertaining to agency funds, as set by 

the Governmental Accounting Standards Board, or GASB, state it is 
necessary for the financial statements to disclose the changes in the 
government's custodial responsibilities .® 


These standards, which are nonauthoritative guidance but help to 
determine GASB’s intent, go on to indicate that not only should cash 
receipts and disbursements be reported, but all activity should be 
measured and reported on the accrual basis. The GASB codification 
also provides an example showing individual agency fund totals 
instead of simply showing an aggregate total of all agencies’ funds, 
the practice the City uses.’ This presentation is more transparent as it 
provides greater detail of the changes in the government's custodial 
responsibilities. 


There is some ambiguity in the authoritative section of GASB 
codification on accounting for custodial agency funds. As a result, the 
Controller's Office appears to have misapplied the relevant accounting 
standards in compiling financial data for the Denver Public Trustee 
agency fund by reporting the net activity rather than the gross activity. 


The Controller’s Office has historically aggregated all agency funds for 
the purposes of disclosure in the City’s comprehensive annual financial 
report, as this is still permissible under GASB principles. 


7 City and County of Denver, Fiscal Accountability Rules, Rule 11.2 (revised 2016). Accessed February 6, 2019, https://www.denvergov.org/ 
content/dam/denvergov/Portals/344/documents/Fiscal_Rules/chapter_11_Fin_Rpt/Rules/Rule_11_2_FinancialDisclosures_2016 11 15. 
pdf. 


8 Governmental Accounting Standards Board, GASB Cod. Sec. 2200.906. Accessed February 6, 2019, https://garsapp.gasb.org/. 
° Governmental Accounting Standards Board, GASB Cod. Sec. 2200.906, Exhibit 9. Accessed February 6, 2019, https://garsapp.gasb.org/. 
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However, aggregating the agency funds for disclosure purposes does 
not provide transparency for the operations of the City’s agency funds, 
which is particularly important as agency funds belong to entities 
outside the City. We noted that the activity reported in the agency fund 
schedule in the comprehensive annual financial report aggregates 
multiple agency funds used for a variety of purposes. As a result, the 
amounts relating to individual agency funds of the City, such as the 
Denver Public Trustee, are not transparently disclosed. 


RECOMMENDATION 1.1 


Report All Denver Public Trustee Activity — The Controller's Office should work with the Denver 
Public Trustee to develop a process to ensure the full amount of additions and deductions are 
reported to the Controller's Office and that those amounts are fully accounted for in the City’s 
comprehensive annual financial report, beginning with the December 31, 2018 report. 


Agency Response: Agree, Implementation Date - May 31, 2019 


RECOMMENDATION 1.2 


Disaggregate Agency Fund Reporting -In the interest of promoting greater transparency, 

the Controller's Office should consider disaggregating its reporting of the City’s agency funds 

in the comprehensive annual financial report going forward. This will allow the public to see 

the balances of assets and liabilities that relate to each fund at the beginning of the year, all 
additions and deductions relating to each fund, and the ending balances by fund at year-end. 


Agency Response: Agree, Implementation Date - May 31, 2020 
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FINDING 2 


The Denver Public Trustee Has a Significant Weakness in Internal Controls 


Key Policies and 
Procedures Are 
Insufficient 


“Standards for Internal Control in the Federal Government,” also known 
as the federal “Green Book,” defines internal control as “a process 
effected by an entity’s oversight body, management, and other 
personnel that provides reasonable assurance that the objectives of 

an entity will be achieved.”'? In essence, this means that an entity has 
implemented written policies and procedures that ensure operations 
are effective, efficient, reliable, and in compliance with applicable laws 
and regulations. 


During the course of our audit, we identified several deficiencies in the 
Denver Public Trustee’s internal controls over accounting. We believe 
the impact of these combined deficiencies results in a “significant 
weakness” in the overall internal control structure of the Denver Public 
Trustee.'' We identified deficiencies related to the accounting system, 
the bank reconciliation process, cash receipts, cash disbursements, 
overall policies and procedures, and information technology general 
controls. 


We noted that written policies and procedures do not exist for certain 
key functions, such as the review of foreclosure filings for completeness 
and accuracy. Because information is manually entered into the 
foreclosure case management system, there is an increased likelinood 
of error. 


Although the Denver Public Trustee recognizes the need for a review 
process and has assigned this responsibility to a clerk, we found that 
policies and procedures to direct the foreclosure review process are 
not formalized in writing. Additionally, no evidence exists to show 

that review procedures were, in fact, performed. As a result, there 

is an increased risk foreclosure case files could contain erroneous 
information. This also could lead to inefficiencies and potential 
disruption to operations in the event there is turnover in key personnel. 


1 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. OV1.01 

(2014). Accessed February 6, 2019, http://www.gao.gov/assets/670/665712.pdf. The U.S. Government Accountability Office publishes 
standards and best practices for effective government practice. The office is an independent, nonpartisan agency that works for Congress. 
These standards, commonly referred to as the federal “Green Book,” establish effective internal control systems that ensure efficiency, 
effectiveness of operations, and compliance with laws and regulations. 


11 A “significant weakness” is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility 
that a significant misstatement of the entity’s financial statements or processes will not be prevented, or detected and corrected, ona 


timely basis. 
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Not establishing formal written policies and procedures for all aspects 

of the Denver Public Trustee's operations is the result of not providing 
adequate attention to internal controls. The federal Green Book 

defines standards for internal control in the federal government 

through a hierarchical structure of five components and 17 principles. 
These principles are used by organizations, including state and local 
governments, to develop an effective system of internal control.'* Figure 
3 details these components and principles. 


FIGURE 3. U.S. Government Accountability Office's 5 Components and 17 Principles of Internal Control 
Control Environment Control Activities 


The oversight body and management should . Management should design control activities 
demonstrate a commitment to integrity and to achieve objectives and respond to risks. 


etledivawes Management should design the entity's 


The oversight body should oversee the entity’s information system and related control 
internal control system. activities to achieve objectives and respond 


Management should establish an to risks. 


organizational structure, assign responsibility, . Management should implement control 
and delegate authority to achieve the entity’s activities through policies. 
objectives. 


Management should demonstrate a 
commitment to recruit, develop, and retain 
competent individuals. 


Management should evaluate performance 
and hold individuals accountable for their 
internal control responsibilities. 


Management should use quality information 
to achieve the entity’s objectives. 


Management should internally communicate 
the necessary quality information to achieve 
the entity’s objectives. 


Risk Assessment Management should externally communicate 


the necessary quality information to achieve 
Management should define objectives clearly the entity’s objectives. 
to enable the identification of risks and define 
risk tolerances. 


Management should identify, analyze, and 
respond to risks related to achieving the 
defined objectives. 


Monitoring 


Management should establish and operate 
monitoring activities to monitor the internal 
control system and evaluate the results. 


Management should consider the potential 
for fraud when identifying, analyzing, and 


responding to risks. 
Management should remediate identified 


Menegenmeni Sivel Mel itenim, Enez, Cne internal control deficiencies on a timely basis. 


respond to significant changes that could 
impact the internal control system. 


Source: U.S. Government Accountability Office, “Standards for Internal Control in the Federal Government.” 


2 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. OV2.04 (2014). 
Accessed February 6, 2019, http://www.gao.gov/assets/670/665712.pdf. 
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RECOMMENDATION 2.1 


Update Key Policies and Procedures — The Denver Public Trustee should establish and document 
formal policies and procedures for key processes, such as the foreclosure review process, by the 


end of 2019. Policies and procedures should be designed to incorporate the five components 
and 17 principles of the internal control framework issued by the U.S. Government Accountability 
Office. 


Agency Response: Agree, Implementation Date — June 30, 2020 


The Denver Public For accounting purposes, the Denver Public Trustee primarily relies on 
Trustee Lacks an its foreclosure management software, Benchmark. The division uses 
Adequate System to batch processes to record revenue transactions in the City’s Enterprise 
Account for Its Financial Cashiering System and posts an annual summary entry for the agency 
Transactions fund transactions into Workday, the City’s accounting system of 
record. While the City allows the use of subsidiary systems of record, 
such as Benchmark, we found several instances when Benchmark 
was not producing data consistent with the requirements of City Fiscal 
Accountability Rules. The rules require subsidiary systems that interface 
with a City system of record to “create, maintain, and communicate alll 
relevant information required in the system of record” and “ensure the 
integrity of data.” !9 


Specifically, we found that the financial reporting data provided to 

the Controller's Office was incomplete, and revenues recorded into 

i Workday were incorrectly allocated between Workday accounts. 

Benchmark is not Finally, rather than having transaction data transferred between 

Give GeCouniing systems through automated integrations, significant manual intervention 

system. is needed to process transactions. This creates delays in processing data 
and increases risk of errors in the data. 


The Green Book says “management should use quality information to 
achieve the entity’s objectives.”'4 The Green Book further notes that the 
data should be timely, relevant, and gathered from reliable sources, 
whether internal or external. The Denver Public Trustee’s accounting 
practices are not in alignment with this guidance. 


8 City and County of Denver, Fiscal Accountability Rules, Rule 1.2 (revised 2018). Accessed February 6, 2019, https://www.denvergov. 
org/content/dam/denvergov/Portals/344/documents/Fiscal_Rules/chapter_1_Acctg_Principles_and_Standards/Rules/Rule_1.2_ 
SystemOfRecord.pdf. 


4 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. 13.01 and 13.04 
(2014). Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 
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Accounting processes use data from Benchmark along with 
spreadsheets to process transactions. When Workday was brought 
online in 2017, the Denver Public Trustee did not have adequate 
resources available to develop an integration between Benchmark and 
Workday, limiting the ability of the office to use Workday. 


Relying on Benchmark—which we observed is not designed as a true 
accounting system—along with spreadsheets creates inefficiencies, 
because office accounting staff need to build labor-intensive 
workarounds to help with managing transactions. With the use of 
spreadsheets for processing significant accounting data, there is 

a heightened risk of errors and inaccuracies in the data ultimately 
uploaded to Workday. 


RECOMMENDATION 2.2 


Integrate Benchmark with Workday - The Denver Public Trustee, in conjunction with the 
Controller's Office and the Technology Services agency, should determine if an integration can 
be built to transfer financial information from Benchmark into Workday by the end of 2019. 


Agency Response: Agree, Implementation Date - December 31, 2019 


RECOMMENDATION 2.3 


Record All Transactions in Workday - In addition to developing and implementing integrations 
between Benchmark and Workday, the Denver Public Trustee should immediately record the 
summary of daily transaction activity into Workday on a timely basis and use Workday as its 
primary system of accounting. 


Agency Response: Agree , Implementation Date - December 31, 2019 


Revenue Is Improperly While observing the Denver Public Trustee's monthly reporting of 

Allocated in Workday revenue, we identified inaccuracies in the allocation of revenue 
recorded in Workday, the City’s accounting system of record, and a 
lack of management review of these revenue transactions. 


A single person is solely responsible for recording and reconciling these 
transactions. For example, the Denver Public Trustee in November 
2018 reported “postage” revenue in the amount of $403, but this 

was improperly allocated to the “copies” category. By not properly 
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allocating revenue to the correct category in Workday, there is an 
increased likelinood of mistakes, errors, and inaccuracies in the City’s 
accounting records. This is indicative of a larger issue related to weak 
internal controls around recording transactions. 


The Green Book says management should have controls so all 
transactions are “completely and accurately recorded.”'> The Green 
Book also recognizes that a smaller entity, such as the Public Trustee, 
“faces greater challenges in segregating duties because of its 
concentration of responsibilities and authorities in the organizational 
structure. Management, however, can respond to this increased risk 
through the design of the internal control system, such as by adding 
additional levels of review for key operational processes, reviewing 
randomly selected transactions and their supporting documentation, 
taking periodic asset counts, or checking supervisor reconciliations.” '* 


RECOMMENDATION 2.4 


Improve Policies and Procedures for Revenue Transactions — The Denver Public Trustee should, 
by the end of 2019, develop and implement formal written policies and procedures requiring 


revenue transactions be reconciled and reviewed after they are recorded in the City’s Enterprise 
Cashiering System and in Workday, and that this be done by someone other than the person 
who recorded the transactions. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Automatically Assessed The Denver Public Trustee's foreclosure management system, 
Fees Are Not Regularly Benchmark, includes outdated fee information. Fees charged by the 
Reviewed division are set and updated by state laws that require specific amounts 
for different activities. Table 2 on the following page lists some of the 
fees. 


During our audit, we observed that many of the fees included in the 
Benchmark system were only applicable under outdated rules that 
have been replaced. As an example, the Denver Public Trustee’s office 
used a different software system before implementing the current 
Benchmark system. The previous software system charged a $65 usage 
fee for each file processed and that fee was still active in Benchmark, 


1 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. 10.03 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 


16 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. OV4.05 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 
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TABLE 2. Partial List of Fees Charged by Denver Public Trustee 


C 


Opening and Administering a Foreclosure* $150 
Notice of Subordinate Lien Holder's Intent to Redeem $50 
Fee to Restart Foreclosure after Bankruptcy $75 
Withdrawal Fee $35 


Source: Denver Public Trustee. 


Note: * The fee is $150 if “the original principal amount or the outstanding balance (whichever is less) is equal to or under 
$480,000.” If the outstanding balance is greater than $480,000, then the fee is 0.00031 percent of the outstanding balance. 


even though it is no longer needed. Other fees are possibly duplicates 
of legitimate fees, but with names that are either unclear or unusable. 
We also observed that the Denver Public Trustee’s office does not have 
a written policy to periodically review and update the fee schedule in 
Benchmark. 


In response to this audit, the Denver Public Trustee updated its fees 

to prevent employees from using the outdated fees identified by the 
audit team. Had these outdated fees remained available in the system, 
employees could have selected one, which could charge the wrong 
amount to a lien holder or property owner. Because Benchmark is a 
relatively new system for the Denver Public Trustee, the division has not 
developed a regular review process. 


RECOMMENDATION 2.5 


Create Policies and Procedures for Fees — The Denver Public Trustee should, by the end of 2019, 
create and implement formal written procedures for regularly reviewing active fees that can 
be charged to an account. This procedure should ensure fees align with current state law and 
ensure there are no outdated or incorrect fees available to employees. 


Agency Response: Agree, Implementation Date — June 30, 2019 
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Checks Are The Denver Public Trustee's practice is to print and hold checks owed to 

Inappropriately Held former property owners. When a foreclosed property sells at auction, or 
the outstanding debt is otherwise satisfied, any excess funds are paid to 
the former property owner. Due to the limitations of the Denver Public 
Trustee's accounting system, as a matter of expediency, the division 
regularly prints and holds these checks for the foreclosed-upon property 
owner to claim when submitting the necessary documentation to file a 
claim to receive the excess funds. 


Holding While we did not identify any misappropriated checks, holding 
preprinted checks preprinted checks creates a risk of fraud for the Denver Public Trustee. 
creates a risk The Green Book notes that one fraud risk factor is when “circumstances 


exist, such as the absence of controls, ineffective controls, or the abilit 
of fraud for the i i aia 
i of management to override controls, that provide an opportunity to 
Denver Public commit fraud.” 
Trustee. 
The Green Book also notes that management should design control 
activities to, among other activities, “secure and safeguard vulnerable 
assets. Examples (of vulnerable assets) include ... cash, securities, 
inventories, and equipment that might be vulnerable to risk of loss or 
unauthorized use.”!8 


Because these checks have not been issued and are still in the 
possession of the Denver Public Trustee, there is a risk they could be 
misappropriated. Transitioning responsibility for check-writing to the 
Controller's Office will reduce risks of misappropriation in the check- 
writing process. 


RECOMMENDATION 2.6 


Move Check-Writing to Controller’s Office — The Denver Public Trustee, in conjunction with 


the Controller’s Office, should develop a plan to move the function of check-writing to the 
Controller's Office by the end of 2019. 


Agency Response: Agree, Implementation Date - December 31, 2019 


17 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. 8.04 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 


18 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. 10.03 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 
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RECOMMENDATION 2.7 


Prohibit Preprinting of Checks — Until Recommendation 2.6 is implemented, the Denver Public 


Trustee should immediately update its written policies and procedures to prohibit the practice of 
printing checks in advance. 


Agency Response: Agree, Implementation Date — June 30, 2020 


Held Checks Are Not We observed that the Denver Public Trustee does not distinguish 
Properly Treated for between held and outstanding checks in its bank reconciliation form, 

Accounting Purposes treating both as outstanding checks. A “held check” is one that has 
been written but has not yet been sent to the payee; an “outstanding 
check” is one that has been sent to the payee but has not cleared 
the bank account from which it is drawn. As of October 31, 2018, the 
Denver Public Trustee had incorrectly recorded 12 printed and held 
checks as outstanding, resulting in an understatement of $268,000 in 
cash and accounts payable. 


There are significant differences in how these checks should be treated 
for accounting purposes. Held checks are checks that have not yet 
been sent to a payee, so the underlying cash remains under the control 
of the issuer. As such, held checks should not reduce reported cash 
balances at year-end. Meanwhile, outstanding checks, which are no 
longer in the issuer’s control, should reduce year-end cash balances. 


According to the Governmental Accounting Standards Board, “assets 
are resources with present service capacity that the government 
presently controls.”'? Because held checks have not been issued 

and are still in the possession of the public trustee, they still meet the 
definition of an asset. The reason the held checks were not treated 
properly was that the Denver Public Trustee was not aware of the 
accounting difference between held and outstanding checks, which 
resulted in an understatement of the Denver Public Trustee’s October 
31, 2018 cash balance of $268,000. Moving bank reconciliation 
functions to the Controller's Office, which handles bank reconciliations 
for most of the City, would allow the Denver Public Trustee to leverage 
the expertise of the Controller’s Office and reduce risks of error in the 
bank reconciliation process and related processes. 


19 Governmental Accounting Standards Board, Concepts No. 4: Elements of Financial Statements (2007). Accessed February 12, 2019, 
https://www.gasb.org/cs/ContentServer?c=Page&cid=1176160042391&d=&pagename=GASB%2F Page%2FGASBSectionPage. 
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RECOMMENDATION 2.8 


Move Bank Reconciliation Process to Controller's Office — The Denver Public Trustee, in 
conjunction with the Controller's Office, should develop a plan to move the function of 
performing bank reconciliations to the Controller's Office by the end of 2019. 


Agency Response: Agree, Implementation Date — June 30, 2020 


RECOMMENDATION 2.9 


Update Bank Reconciliation Form — Until Recommendation 2.8 can be implemented, the Denver 
Public Trustee should immediately update its bank reconciliation form to distinguish between 
outstanding checks and held checks and account for both held checks and outstanding checks 
in accordance with Governmental Accounting Standards Board guidance. 


Agency Response: Agree, Implementation Date - December 31, 2018 


Service Organization A “service organization” is a third-party vendor that provides services 
Controls Reports critical to the City’s operations and internal control structure. The 

Are Not Reviewed Denver Public Trustee relies on third-party service organizations for vital 
services, such as managing fees, tracking requirements to keep the 
foreclosure process moving, recording prices paid by and amounts 
owed to stakeholders, and conducting foreclosure auctions. Improper 
or erroneous changes made to the software system by a service 
organization can interfere with the Denver Public Trustee’s operations, 
which could create delays in the foreclosure process or create an 
opportunity for funds to be misappropriated. 


To prevent this risk, the Denver Public Trustee should take steps 

to understand how its service organizations operate and to also 
understand the controls the service organization has in place for 
operating and managing changes to its system. The Green Book 
says “management needs to understand the controls each service 
organization has designed, has implemented, and operates for the 
assigned operational process and how the service organization’ s 
internal control system impacts the entity's internal control system.” 
Such understanding of a service organization is important because, 


20 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. OV4.01 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 
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even though these are external systems, the City and the Denver Public 
Trustee are ultimately responsible for their operations. 


According to the City’s Fiscal Accountability Rules, the Denver Public 
Trustee must annually attest to the effectiveness of its controls, including 
those at its service organizations.?! The American Institute of Certified 
Public Accountants provides a framework for service providers to 
provide an independent attestation report that certifies the suitability 
of the design and operation of a service provider's internal controls— 
A referred to as a Service Organization Controls report. An independent 
The Denver Public firm formally provides this assurance. 
Trustee’s third- 


party vendors However, we found that the Denver Public Trustee has not obtained 


Service Organization Controls reports from its third-party service 


could not providers. In the absence of these reports, the Denver Public Trustee has 
provide Service implemented some mitigating controls, such as a testing environment 
Organization for one of the two software systems managed by service organizations. 
Controls reports. In a testing environment, changes to the system can be vetted and 


verified before affecting live data. However, these controls do not 
consider all risks related to system changes. There is still a risk changes 
made to the underlying code could have unintended effects on other 
parts of the system—resulting in incorrect reports, calculations, or other 
outputs. There also could be changes made to code that were not 
clear and, therefore, not thoroughly tested. 


Auditors worked with the third-party vendors to try to obtain Service 
Organization Controls reports, but neither of the Denver Public Trustee's 
service organizations could provide the reports. 


When implementing third-party systems, the Denver Public Trustee 
prioritized statutory compliance and efficiency but did not give 
adequate attention to internal controls for achieving its goals. If 
internal controls are lacking, the Denver Public Trustee is at risk of not 
complying with the City’s Fiscal Accountability Rules, exposing the City 
to increased risk of transactions being incorrectly processed. 


21 City and County of Denver, Fiscal Accountability Rules, Rule 1.1 (revised 2008). Accessed February 6, 2019, https://www.denvergov. 
org/content/dam/denvergov/Portals/344/documents/Fiscal_Rules/chapter_1_Acctg_Principles_and_Standards/Rules/Rule_1_1 Acctg_ 
Principles_and_Standards.pdf. 


22 American Institute of Certified Public Accountants, Statement on Standards for Attestation Engagements No. 18, Attestation Standards: 
Clarification and Recodification. Accessed February 6, 2019, https://www.aicpa.org/content/dam/aicpa/research/standards/auditattest/ 
downloadabledocuments/ssae-no-18.pdf. 
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RECOMMENDATION 2.10 


Obtain and Review Service Organization Controls Reports — The Denver Public Trustee should 
work with third-party vendors that provide critical services to obtain Service Organization Controls 
reports from them by the end of 2019. These reports should be carefully reviewed to determine if 
there are any weaknesses or gaps in the controls provided by the vendor and to identify critical 
“user controls” the Denver Public Trustee needs to have in place to rely on the vendor’s controls. 


Agency Response: Agree, Implementation Date - December 31, 2019 


RECOMMENDATION 2.11 


Develop and Implement Policies and Procedures for Service Organizations — The Denver Public 
Trustee should develop and implement formal written policies and procedures for monitoring 
its third-party vendors that provide critical services but that do not have Service Organization 
Controls reports available by the end of 2019. These policies and procedures should address 
all critical requirements that would otherwise be addressed in a standard Service Organization 
Controls report. 


Agency Response: Agree, Implementation Date - December 31, 2019 


The Denver Public We found that the Denver Public Trustee has assigned incompatible job 
Trustee Has Insufficient responsibilities to one employee. Specifically, we noted that a single 
Segregation of Duties employee has primary or secondary responsibility for performing almost 
all critical financial processes. 


For example, the employee can create check requests, approve check 
requests, print checks, and create and submit the positive pay file to the 
bank.” The employee also approves or rejects positive pay exceptions 
and reconciles the bank accounts. While the employee is not able to 
sign checks, the ability to approve “positive pay” exceptions allows for 
that control to be overridden. This employee has similar levels of power 
in the cash receipts process. 


Based on our inquiries and observations, we found that the Denver 
Public Trustee has limited personnel and operating budget available to 


23 “Positive pay” is a service provided by a bank that helps protect against fraudulent check activity. After a check is issued, the issuer 
provides the check information to the bank. Prior to processing the check, the bank uses this information to verify that the check is valid 
and approved. If discrepancies are detected, the bank stops processing the check and notifies the issuer of the discrepancy. 


| Timothy M. O’Brien, CPA | M. O’Brien, CPA Page 18 


Denver Auditor 


allocate adequate resources to develop an effective system of internal 
controls, specifically related to the segregation of duties. Furthermore, 
our inquiries and observations also indicate the office has not given 
adequate attention to developing a robust system of financial internal 
controls, and has instead focused on meeting its goals of serving the 
public and ensuring compliance with state law. 


City Fiscal Accountability Rules say “no one person should be able 

to prepare a transaction, approve it, process it, and then reconcile 
department records to the accounting system.” Furthermore, the rules 
say that, “in small agencies or departments, where separation is difficult 
to achieve, a high level of management oversight of the financial 
related activities is required as a compensating control activity.” The 
rules also require agency heads in small agencies to develop a plan to 
cross-train employees by having staff members periodically rotate jobs 
to mitigate the risks that arise from a lack of segregation of duties.’ 


Meanwhile, Fiscal Accountability Rules also require each agency to 
annually certify it has established effective internal controls. 


The Green Book says segregation of duties reduces the risk of error, 
misuse, or fraud. This includes separating the responsibilities for 
authorizing transactions, processing and recording transactions, 
reviewing transactions, and handling any related assets, so that no 
single individual controls all key aspects of a transaction.” 


As previously stated, the Green Book also says smaller entities 

face greater challenges in segregating duties because of the 
concentration of responsibilities and authorities in its organizational 
structure. Management can respond to this increased risk through 
internal controls—such as by adding additional levels of review for key 
operational processes, reviewing randomly selected transactions and 
their supporting documentation, or checking supervisor reconciliations.” 


24 Compensating control activities are additional controls that are needed when the main control is not working. In this example, the main 
control is proper segregation of duties. Because there are not enough people to have effective segregation of duties, management needs 
to perform additional levels of reviews. 


235 City and County of Denver, Fiscal Accountability Rules, Rule 2.4 (revised 2008). Accessed February 6, 2019, https://www.denvergov. 
org/content/dam/denvergov/Portals/344/documents/Fiscal_Rules/chapter_2_Internal_Controls/Rules/Rule_2_4 Sep_and_Rotation_of_ 
Duties. pdf. 


6 City and County of Denver, Fiscal Accountability Rules, Rule 11.2 (revised 2016). Accessed February 6, 2019, https://www. 
denvergov.org/content/dam/denvergov/Portals/344/documents/Fiscal_Rules/chapter_11_Fin_Rpt/Rules/Rule_11_2_ 
FinancialDisclosures_2016_11_15.pdf. 


27 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. 10.03 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 


28 U.S. Government Accountability Office, GAO-14-704G, Standards for Internal Control in the Federal Government, para. OV4.05 (2014). 
Accessed February 6, 2019, https://www.gao.gov/assets/670/665712.pdf. 
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As a result of an inadequate segregation of duties, the Denver Public 
Trustee is exposed to a significant amount of fraud risk, as well as related 
risks of error or omissions. 


RECOMMENDATION 2.12 


Strengthen Segregation of Duties - The Denver Public Trustee should improve segregation of 
duties by conducting and documenting a thorough review of the current duties assigned to 

its staff, including identifying incompatible job responsibilities by the end of 2019. The Denver 
Public Trustee should then remove some incompatible duties from personnel with excessive 
responsibilities and move those responsibilities to other personnel. For example, a single employee 
should not have the authority to create and submit the positive pay file as well as have the 
responsibility to approve or reject positive pay exceptions. 


Agency Response: Agree, Implementation Date - December 31, 2019 


User Access Policies Individuals with inappropriate levels of access can make unauthorized 
for Critical Information changes to Denver Public Trustee information systems. While we did not 
Systems Are Inadequate see any evidence of unauthorized changes, inadequate written policies 
surrounding access management and user permissions leave critical 
information systems at risk. For example, a user with inappropriate 
access could override the amount paid for a property, which could 
result in a lien holder being incorrectly paid. 


We identified instances when user access to Benchmark, the agency's 
foreclosure case management system, had not been revoked for 
individuals who no longer worked for the Denver Public Trustee. Users 
who leave the Denver Public Trustee’s office should not be able to 
access or make changes in Benchmark. However, because user access 
is not regularly reviewed, these individuals still had the ability to access 
the system. This occurred because there is no written policy in the Public 
Trustee’s office to regularly review user permissions to determine if those 
permissions are still appropriate. In addition, the Denver Public Trustee 
does not have a written policy to review access rights for departing 
employees to ensure access is promptly removed. 


Best practices require an organization to take proper steps to ensure 
user permissions are appropriate for the user's purpose. The Federal 
Information Systems Control Manual recommends user permissions 
be well-documented and regularly reviewed. A user’s access should 
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match what is necessary to accomplish their job function.” Further, the 
National Institute of Standards and Technology requires management 
to regularly review accounts for compliance.*° 


Some Denver Public Trustee user accounts have permissions to override 
controls. For instance, management can both request payments 
issued from the system and manage users. Hypothetically, system 
administrators can create users, alter key information, such as payee or 
the amount of a payment, request payments, and approve payment. 
The National Institute of Standards and Technology says information 
systems should separate duties by function to reduce risk. Specifically, 
the institute suggests “dividing mission functions and information system 
support functions among different individuals and/or roles.”*! 


The Denver Public Trustee frequently needs to add users to its system, 
including external users. Therefore, the Denver Public Trustee has, in the 
past, kept user management functions internal. However, the division 
would improve internal controls by outsourcing this function. 


RECOMMENDATION 2.13 


Delegate Authority for User Permissions — To better segregate duties, the Denver Public Trustee 
should, by the end of 2019, assign the ability for modifying user permissions to someone who does 
not have other responsibilities in Benchmark. 


Agency Response: Agree, Implementation Date — June 30, 2019 


RECOMMENDATION 2.14 


Implement Timely Removal of Access — The Denver Public Trustee should immediately create and 
implement formal written policies and procedures for the timely removal of access for terminated 
or transferred employees. 


Agency Response: Agree, Implementation Date - December 31, 2019 


22 U.S. Government Accountability Office, GAO-09-232G, Federal Information System Controls Audit Manual (2009). Accessed February 
6, 2019, https://www.gao.gov/assets/80/77142.pdf. The Federal Information Systems Control Manual sets guidelines for effective 
management of information systems, including managing risk. 

3° National Institute of Standards and Technology, NIST Special Publication 800-53 (Rev. 4), Security Controls and Assessment Procedures 
for Federal Information Systems and Organizations (2013). Accessed February 6, 2019, https://nvd.nist.gov/800-53/Rev4. The National 
Institute of Standards and Technology is a laboratory and non-regulatory federal agency within the U.S. Department of Commerce. 

31 National Institute of Standards and Technology, NIST Special Publication 800-53 (Rev. 4), Security Controls and Assessment Procedures 
for Federal Information Systems and Organizations (2013). Accessed February 6, 2019, https://nvd.nist.gov/800-53/Rev4. 
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RECOMMENDATION 2.15 


Develop Review Process for User Permissions — The Denver Public Trustee should create and 


implement formal written policies and procedures to periodically review user permissions to 
ensure all users have appropriate access to Denver Public Trustee information systems and that 
there are no unauthorized users with access to the information systems by the end of 2019. 


Agency Response: Agree, Implementation Date — June 30, 2020 
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FINDING 3 


Payroll Approvals Are Accurate and Timely 


We found that managers in the Denver Public Trustee are verifying all 
employee time sheets in accordance with City Fiscal Accountability 
The Denver Rules, which require managers to approve employee payroll within two 
J business days following the end of any pay period.” 
Public Trustee’s 


time sheets are Auditors verified the time sheet approvals required from May 1, 2018, 
approved ina through November 31, 2018, and found managers have approved time 
ti ly manner sheets within the designated time frame. Even in instances when one 

HAN E manager was not available, another manager successfully approved 
the time sheets. 


This shows the Denver Public Trustee has taken steps to ensure time 
sheets are approved in a timely manner. These approvals help ensure 
accountability that employees are paid for the time they worked and 
not overpaid due to error or misrepresentation. 


3? City and County of Denver, Fiscal Accountability Rules, Rule 10.13 (revised 2016). Accessed February 6, 2019, https://www.denvergov. 
org/content/dam/denvergov/Portals/344/documents/Fiscal_Rules/chapter_10_Empl_Associated/Rules/Rule_10.13TimeAndAttendance. 
pdf. 
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RECOMMENDATIONS 


1.1 


2.1 


Report All Denver Public Trustee Activity — The Controller's Office should work with the Denver 
Public Trustee to develop a process to ensure the full amount of additions and deductions are 
reported to the Controller's Office and that those amounts are fully accounted for in the City’s 
comprehensive annual financial report, beginning with the December 31, 2018 report. 


Agency Response: Agree, Implementation Date - May 31, 2019 


Agency Narrative: We agree with the recommendation. Beginning with the 2018 
Comprehensive Annual Financial Report (CAFR), we will report the additions and deductions 
of the Public Trustee fund at the gross amounts where they were previously reported at the net 
amount. 


Disaggregate Agency Fund Reporting -In the interest of promoting greater transparency, 
the Controller’s Office should consider disaggregating its reporting of the City’s agency funds 
in the comprehensive annual financial report going forward. This will allow the public to see 
the balances of assets and liabilities that relate to each fund at the beginning of the year, all 
additions and deductions relating to each fund, and the ending balances by fund at year- 
end. 


Agency Response: Agree, Implementation Date - May 31, 2020 


Agency Narrative: We agree with the recommendation. In 2019 we will be implementing GASB 
84 - Fiduciary Activities which updates guidance on the classification of fiduciary activities and 
how those activities are reported. As part of the implementation process we will be replacing 
the Statement of Changes in Assets and Liabilities - Agency Funds with a new Statement of 
Changes in Net Position. We will ensure the amounts reported in the Fiduciary Fund financial 
statements are disaggregated by source, making the data more transparent for the reader. 


Update Key Policies and Procedures — The Denver Public Trustee should establish and 
document formal policies and procedures for key processes, such as the foreclosure review 
process, by the end of 2019. Policies and procedures should be designed to incorporate 
the five components and 17 principles of the internal control framework issued by the U.S. 
Government Accountability Office. 


Agency Response: Agree, Implementation Date — June 30, 2020 


Agency Narrative: The Public Trustee’s Office agrees with this recommendation. While 

the Public Trustee staff are well trained in their duties, we acknowledge that written 
documentation of our procedures are needed and would improve our internal controls. 

We are exploring the feasibility of engaging a professional writer to assist us in the task of 
developing a complete manual by December 31, 2019. Should this prove infeasible, the office 
will work on creating the documentation in house with the goal of completion by June 30, 
2020. 
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2.2 Integrate Benchmark with Workday - The Denver Public Trustee, in conjunction with the 
Controller's Office and the Technology Services agency, should determine if an integration 
can be built to transfer financial information from Benchmark into Workday by the end of 2019. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: The Public Trustee’s Office agrees with this recommendation based on 
pending discussions with the Controller's Office, Technology Services and the vendors of 

the two software systems. We acknowledge that an integration between Benchmark and 
Workday could be useful and is a topic worth exploring. We plan to have discussions regarding 
the feasibility of an integration and make a determination by December 31, 2019. 


2.3 Record All Transactions in Workday - In addition to developing and implementing integrations 
between Benchmark and Workday, the Denver Public Trustee should immediately record the 
summary of daily transaction activity into Workday on a timely basis and use Workday as its 
primary system of accounting. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: The Public Trustee’s Office agrees with this recommendation, pending 

the outcome of discussions with the Controller's Office. The Public Trustee's Office currently 
uploads only revenue activity into Workday on a monthly basis. The Public Trustee's Office 
can see the value of increasing the frequency of the uploads to daily and adding additional 
transaction types. The Public Trustee’s Office is committed to working with the Controller’s 
Office and the vendors fo modify current processes and procedures as needed. The 
requested discussions will be at the same time as in Recommendation 2.2. Our goal of 
completion is December 31, 2019. 


2.4 Improve Policies and Procedures for Revenue Transactions — The Denver Public Trustee should, 
by the end of 2019, develop and implement formal written policies and procedures requiring 
revenue transactions be reconciled and reviewed after they are recorded in the City’s 
Enterprise Cashiering System and in Workday, and that this be done by someone other than 
the person who recorded the transactions. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: Regarding the revenue posting mentioned in the Audit Report, please 
note this item was corrected via a journal in 2018. We would like fo clarify the City’s Enterprise 
Cashiering System's (ECS) role in this process. Each revenue transaction that occurs within the 
Public Trustee's Office is first recorded into Benchmark. Monthly, a summary of revenue earned 
is generated from Benchmark, reviewed, and then used to issue an ACH transaction. This ACH 
moves the funds from the Denver Public Trustee's account to the City. Once the funds are 
moved, the agency uses ECS to create revenue postings in Workday. Our agency does have 
a review and reconciliation process in place for all items processed daily through the ECS. 

We agree improving the segregation of duties and providing written policies and procedures 
would improve our internal controls overall. The goal of completion for this process will be 
December 31, 2019. 
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2.5 Create Policies and Procedures for Fees — The Denver Public Trustee should, by the end of 2019, 
create and implement formal written procedures for regularly reviewing active fees that can 
be charged to an account. This procedure should ensure fees align with current state law and 
ensure there are no outdated or incorrect fees available to employees. 


Agency Response: Agree, Implementation Date - June 30, 2019 


Agency Narrative: We agree with this recommendation. The Public Trustee has reviewed their 
fees within the Benchmark System and has inactivated any that are no longer relevant. The 
Public Trustee's Office will create a policy and schedule a regular reviewing of the fees to 
ensure any fees that become obsolete will be disabled in a timely manner by June 30, 2019. 


2.6 Move Check-Writing to Controller’s Office — The Denver Public Trustee, in conjunction with 
the Controller’s Office, should develop a plan to move the function of check-writing to the 
Controller's Office by the end of 2019. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: The Public Trustee’s Office recognizes the value of segregating duties. We 
will discuss the feasibility of this recommendation with the Controller’s Office by June 30, 2019. 
Should it be feasible to implement this recommendation, we will work with the Controller's 
Office to develop a plan to implement this recommendation by December 31, 2019. 


2.7 Prohibit Preprinting of Checks — Until Recommendation 2.6 is implemented, the Denver Public 
Trustee should immediately update its written policies and procedures to prohibit the practice 
of printing checks in advance. 


Agency Response: Agree, Implementation Date - June 30, 2020 


Agency Narrative: We agree with this recommendation. The Public Trustee's Office as of 
December 31, 2018 is no longer printing checks in advance, and currently is not holding any 
pre-printed checks. This action will be noted as prohibited in all future written policies and 
procedures. 


2.8 Move Bank Reconciliation Process to Controller's Office — The Denver Public Trustee, in 
conjunction with the Controller's Office, should develop a plan to move the function of 
performing bank reconciliations to the Controller's Office by the end of 2019. 


Agency Response: Agree, Implementation Date - June 30, 2020 


Agency Narrative: The Public Trustee’s Office recognizes the value of segregating duties. We 
will discuss the feasibility of this recommendation with the Controller’s Office by June 30, 2019. 
Should it be feasible to implement this recommendation, we will work with the Controller's 
Office to develop a plan to implement this recommendation by December 31, 2019. 


2.9 Update Bank Reconciliation Form — Until Recommendation 2.8 can be implemented, the 
Denver Public Trustee should immediately update its bank reconciliation form to distinguish 
between outstanding checks and held checks and account for both held checks and 
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outstanding checks in accordance with Governmental Accounting Standards Board 
guidance. 


Agency Response: Agree, Implementation Date - December 31, 2018 


Agency Narrative: We agree with this recommendation. The Public Trustee's Office as if 
December 31, 2018 has eliminated the need to distinguish between held and outstanding 
checks per our response fo 2.7. 


2.10 Obtain and Review Service Organization Controls Reports — The Denver Public Trustee should 
work with third-party vendors that provide critical services to obtain Service Organization 
Controls reports from them by the end of 2019. These reports should be carefully reviewed to 
determine if there are any weaknesses or gaps in the controls provided by the vendor and to 
identify critical “user controls” the Denver Public Trustee needs to have in place to rely on the 
vendor's controls. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: We agree with this recommendation. The Public Trustee's Office sees the 
value in ensuring that a vendor's software performs the tasks we need it to without error, and 
that no errors are introduced into its processes when an update to the software is performed. 
The Public Trustee’s Office will continue to attempt to obtain SOC reports from existing vendors 
and if we obtain them, will work with Technology Services to implement a plan to review them. 


2.11 Develop and Implement Policies and Procedures for Service Organizations — The Denver Public 
Trustee should develop and implement formal written policies and procedures for monitoring 
its third-party vendors that provide critical services but that do not have Service Organization 
Controls reports available by the end of 2019. These policies and procedures should address 
all critical requirements that would otherwise be addressed in a standard Service Organization 
Controls report. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: We agree with this recommendation. For vendors from whom SOC 

reports are not available, the Public Trustee’s Office will commit to having a discussion with 
Technology Services about the feasibility of developing a written policy/procedure document 
that addresses all critical requirements that would otherwise be in a standard SOC report. 


2.12 Strengthen Segregation of Duties — The Denver Public Trustee should improve segregation of 
duties by conducting and documenting a thorough review of the current duties assigned to 
its staff, including identifying incompatible job responsibilities by the end of 2019. The Denver 
Public Trustee should then remove some incompatible duties from personnel with excessive 
responsibilities and move those responsibilities to other personnel. For example, a single 
employee should not have the authority to create and submit the positive pay file as well as 
have the responsibility to approve or reject positive pay exceptions. 


Agency Response: Agree, Implementation Date - December 31, 2019 
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Agency Narrative: We agree with this recommendation. The Public Trustee's accounting 

team is comprised of two people and as with any small accounting team, any changes in 
staff can increase the challenges we face when it comes to the separation of duties. We 

will re-evaluate the current processes and responsibilities for each employee and segregate 
responsibilities as much as possible using other Public Trustee staff where possible. For the 
areas where segregation is more difficult, we will implement more management oversight and 
create a process to document that these checks and balances are taking place. In regards 
to the Positive Pay example, although it appeared that there was only one employee involved 
in the process, there are other employees who also receive the exception emails directly 

from the bank. The process when such an event occurs is fo respond via email fo the other 
employees on the decision to pay or reject and why. We believe we can improve processes 
like this as well as other internal controls by providing them in written form by December 31, 
2019. 


2.13 Delegate Authority for User Permissions — To better segregate duties, the Denver Public Trustee 
should, by the end of 2019, assign the ability for modifying user permissions to someone who 
does not have other responsibilities in Benchmark. 


Agency Response: Agree, Implementation Date - June 30, 2019 


Agency Narrative: We agree with this recommendation. The Public Trustee's Office 
acknowledges there is a deficiency within the segregation of duties regarding user 
permissions with its benchmark tool. However, we are concerned that to comply with this 
recommendation will require intervention from our vendor, Benchmark. We will commit to 
discussing the opportunity with our vendor by June 30, 2019 to determine the feasibility of 
making this change. 


2.14 Implement Timely Removal of Access — The Denver Public Trustee should immediately create 
and implement formal written policies and procedures for the timely removal of access for 
terminated or transferred employees. 


Agency Response: Agree, Implementation Date - December 31, 2019 


Agency Narrative: We agree with this recommendation. The Public Trustee’s Office will work 
with the Clerk and Recorder agency's program staff to include benchmark in their new 
hire/terminated employee process by December 31, 2019. 


2.15 Develop Review Process for User Permissions — The Denver Public Trustee should create and 
implement formal written policies and procedures to periodically review user permissions to 
ensure all users have appropriate access to Denver Public Trustee information systems and that 
there are no unauthorized users with access to the information systems by the end of 2019. 


Agency Response: Agree, Implementation Date - June 30, 2020 


Agency Narrative: We agree with this recommendation. The Public Trustee's Office will 
commit to generating a formal written policy for periodically reviewing User Permissions within 
benchmark and will enact the policy in accordance with recommendation 2.1. 
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AGENCY RESPONSES TO AUDIT RECOMMENDATIONS 


Department of Finance 
Controller's Office 


201 W Colfax Ave, Dept 1109 


E DENVE R Denver, CO 80202 


BP He mie nien ciry p: 720-913-5500 
f: 720-913-5245 


www.denvergov.ore/finance 


March 11, 2019 


Auditor Timothy M. O’Brien, CPA 
Office of the Auditor 

City and County of Denver 

201 West Colfax Avenue, Dept. 705 
Denver, Colorado 80202 


Dear Mr. O’Brien, 


The Office of the Auditor has conducted a performance audit of the Clerk and Recorder’s Office, Office 
of the Public Trustee. 


This memorandum provides a written response for each reportable condition noted in the Auditor’s 
Report final draft that was sent to us on March 6, 2019. This response complies with Section 20-276 (c) 
of the Denver Revised Municipal Code (D.R.M.C.). 


AUDIT FINDING 1 
The Denver Public Trustee’s Fund Activity Is Not Clearly Stated in the City’s Comprehensive 
Annual Financial Report 


RECOMMENDATION 1.1 
Report All Denver Public Trustee Activity — The Controller’s Office should work with 
the Denver Public Trustee to develop a process to ensure the full amount of additions and 
deductions are reported to the Controller’s Office and that those amounts are fully 
accounted for in the City’s comprehensive annual financial report, beginning with the 
December 31, 2018 report. 


Target date to complete 
implementation activities 


Name and phone number 


(Generally expected of specific point of contact 
within 60 to 90 days) for implementation 


Agree May 31, 2019 Kelli Bennett 
720-913-5156 


Narrative for Recommendation 1.1 

We agree with the recommendation. Beginning with the 2018 Comprehensive Annual Financial Report 
(CAFR), we will report the additions and deductions of the Public Trustee fund at the gross amounts 
where they were previously reported at the net amount. 


Agree or Disagree with 
Recommendation 


FOR CITY SERVICES VISIT 


DenverGov.org | yi 
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RECOMMENDATION 1.2 
Disaggregate Agency Fund Reporting — In the interest of promoting greater 
transparency, the Controller’s Office should consider disaggregating its reporting of the 
City’s agency funds in the comprehensive annual financial report going forward. This 
will allow the public to see the balances of assets and liabilities that relate to each fund at 
the beginning of the year, all additions and deductions relating to each fund, and the 
ending balances by fund at year-end. 

Target date to complete 
Agree or Disagree with implementation activities Name miu phone namber 


Recommendation (Generally expected of apee pontar contaci 
within 60 to 90 days for implementation 


Agree May 31, 2020 Kelli Bennett 
720-913-5156 


Narrative for Recommendation 1.2 

We agree with the recommendation. In 2019 we will be implementing GASB 84 — Fiduciary Activities 
which updates guidance on the classification of fiduciary activities and how those activities are 
reported. As part of the implementation process we will be replacing the Statement of Changes in 
Assets and Liabilities — Agency Funds with a new Statement of Changes in Net Position. We will 
ensure the amounts reported in the Fiduciary Fund financial statements are disaggregated by source, 
making the data more transparent for the reader, 


Please contact Kelli Bennett at 720-913-5156 with any questions. 


Sincerely, 


buh Mehamn 


Beth Machann 
City Controller 


cc: Valerie Walling, Deputy Auditor, CPA, CMC® 
Jeremy Creamean, CPA, Audit Supervisor 
Kevin Sear, CPA, CIA, CISA, CFE, CGMA, Audit Manager 
Debra Johnson, Clerk and Recorder 
Juan Guzman, Deputy Clerk and Recorder 
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DEBRA JOHNSON Denver, 
gotes] 


Denver Clerk & Recorder 
Public Trustee . 


March 11, 2019 


Auditor Timothy M. O’Brien, CPA 
Office of the Auditor 

City and County of Denver 

201 West Colfax Avenue, Dept. 705 
Denver, Colorado 80202 


Dear Mr. O’Brien, 


The Office of the Auditor has conducted a performance audit of the Clerk and Recorder’s 
Office, Office of the Public Trustee. 


This memorandum provides a written response for each reportable condition noted in the 
Auditor’s Report final draft that was sent to us on March 6, 2019. This response complies. 
with Section 20-276 (c) of the Denver Revised Municipal Code (D.R.M.C.). 


AUDIT FINDING 2 
The Denver Public Trustee Has a Significant Weakness in Internal Controls 


RECOMMENDATION 2.1 l 
Update Key Policies and Procedures — The Denver Public Trustee should establish 
and document formal written policies and procedures for key processes, such as the 
foreclosure review process, by the end of 2019. Policies and procedures should be 
designed to incorporate the five components and 17 principles of the internal control 
framework issued by the U.S. Government Accountability Office. 

Target date to complete | Name and phone number 
implementation activities of specific point of 


Agree or Disagree with 


Recommendation (Generally expected contact for 
within 60 to 90 days implementation 
John Davies 


720-865-2677 


Narrative for Recommendation 2.1 

The Public Trustee’s Office agrees with this E N While the Public Trustee 
staff are well trained in their duties, we acknowledge that written documentation of our 
procedures are needed and would improve our internal controls. We are exploring the 
feasibility of engaging a professional writer to assist us in the task of developing a 
complete manual by December 31, 2019. Should this prove infeasible, the office will 
work on creating the documentation in house with the goal of completion by June 30, 
2020. 
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RECOMMENDATION 2.2 
Integrate Benchmark with Workday — The Denver Public Trustee, in conjunction 
with the Controller’s Office and Technology Services, should determine if an 
integration can be built to transfer financial information. from Benchmark into 
Workday by the end of 2019. 
Target date to complete | Name and phone number 
Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
i within 60 to 90 days implementation 
= Agree December 31, 2019 John Davies 
720-865-2677 and Lisa 
Sandoval 720-865-8408 
Lo 


Narrative for Recommendation 2.2 

The Public Trustee’s Office agrees with this recommendation based on pending 
discussions with the Controller’s Office, Technology Services and the vendors of the two 
software systems. We acknowledge that an integration between Benchmark and 
Workday could be useful and is a topic worth exploring. We plan to have discussions 
regarding the feasibility of an integration and make a determination by December 31, 
2019. 


RECOMMENDATION 2.3 | 


Record All Transactions in Workday — In addition to developing and implementing 
integrations between Benchmark and Workday, the Denver Public Trustee should 
immediately record the summary daily transaction activity into Workday on a timely 
basis and use Workday as its primary system of accounting. 
Target date to complete | Name and phone number 
Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
within 60 to 90 days implementation 
Agree December 31, 2019 John Davies 
720-865-2677 and Lisa 
Sandoval 720-865-8408 


ak 


Narrative for Recommendation 2.3 

The Public Trustee’s Office agrees with this recommendation, pending the outcome of 
discussions with the Controller’s Office. The Public Trustee’s Office currently uploads 
only revenue activity into Workday on a monthly basis. The Public Trustee’s Office can 
see the value of increasing the frequency of the uploads to daily and adding additional 
transaction types. The Public Trustee’s Office is committed to working with the 
Controller’s Office and the vendors to modify current processes and procedures as 
needed. The requested discussions will be at the same time as in Recommendation 2.2. 
Our goal of completion is December 31, 2019. 
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RECOMMENDATION 2.4 

Improve Policies and Procedures for Revenue Transactions — The Denver Public 
Trustee should, by the end of 2019, develop and implement formal written policies and 
procedures requiring revenue transactions be reconciled and reviewed after they are 
recorded in the City's Enterprise Cashiering System and in Workday, and that this be 
done by someone other than the person who recorded the transactions. 


Target date to complete | Name and phone number 
Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
within 60 to 90 days implementation 
December 31, 2019 Lisa Sandoval (720) 865- 
8408 


Narrative for Recommendation 2.4 

Regarding the revenue posting mentioned in the Audit Report, please note this item was 
corrected via a journal in 2018. We would like to clarify the City’s Enterprise Cashiering 
System’s (ECS) role in this process. Each revenue transaction that occurs within the 
Public Trustee’s Office is first recorded into Benchmark. Monthly, a summary of 
revenue earned is generated from Benchmark, reviewed, and then used to issue an ACH 
transaction. This ACH moves the funds from the Denver Public Trustee’s account to the 
City. Once the funds are moved, the agency uses ECS to create revenue postings in 
Workday. Our agency does have a review and reconciliation process in place for all items 
processed daily through the ECS. We agree improving the segregation of duties and 
providing written policies and procedures would improve our internal controls overall. 
The goal of completion for this process will be December 31, 2019. 


RECOMMENDATION 2.5 

Create Policies and Procedures for Fees — The Denver Public Trustee should, by the 
end of 2019, create and implement formal written procedures for regularly reviewing 
active fees that can be charged to an account. This procedure should ensure fees align 
with current state law and ensure there are no outdated or incorrect fees available to 
employees. 


Target date to complete | Name and phone number 
Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
l within 60 to 90 days implementation 


Agree June 30, 2019 John Davies 
720-865-2677 


Narrative for Recommendation 2.5 

We agree with this recommendation. The Public Trustee has reviewed their fees within 
the Benchmark System and has inactivated any that are no longer relevant. The Public 
Trustee’s Office will create a policy and schedule a regular reviewing of the fees to 
ensure any fees that become obsolete will be disabled in a timely manner by June 30, 
2019. 
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RECOMMENDATION 2.6 
Move Check-Writing to Controller’s Office — The Denver Public Trustee, in 
conjunction with the Controller’s Office, should develop a plan to move the function of 
check-writing to the Controller’s Office by the end of 2019. 
| Target date to complete | Name and phone number 
implementation activities of specific point of 
(Generally expected contact for 
within 60 to 90 days implementation 
December 31, 2019 John Davies 
720-865-2677 and Lisa 
Sandoval (720) 865-8408 


Agree or Disagree with 
Recommendation 


Narrative for Recommendation 2.6 

The Public Trustee’s Office recognizes the value of segregating duties. We will discuss 
the feasibility of this recommendation with the Controller’s Office by June 30, 2019. 
Should it be feasible to implement this recommendation, we will work with the 
Controller’s Office to develop a plan to implement this recommendation by December 
31, 2019. 


RECOMMENDATION 2.7 
Prohibit Preprinting of Checks — Until Recommendation 2.6 is implemented, the 
Denver Public Trustee should immediately update its written policies and procedures 
to prohibit the practice of printing checks in advance. 
Target date to complete 
implementation activities 


Name and phone number 
of specific point of 


Agree or Disagree with 


Recommendation (Generally expected contact for 
within 60 to 90 days) implementation 
Agree See Recommendation 2.1 John Davies 


720-865-2677 and Lisa. 
Sandoval (720) 865-8408 


Narrative for Recommendation 2.7 : 

We agree with this recommendation. The Public Trustee’s Office as of December 31, 
2018 is no longer printing checks in advance, and currently is not holding any pre-printed 
checks. This action will be noted as prohibited in all future written policies and 
procedures. 
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RECOMMENDATION 2.8 
Move Bank Reconciliation Process to Controller’s Office — The Denver Public 
Trustee, in conjunction with the Controller’s Office, should develop a plan to move the 
function of performing bank reconciliations to the Controller’s Office by the end of 
2019. 


Name and phone number 
of specific point of 
contact for 
implementation 
John Davies 
720-865-2677 and Lisa 
Sandoval (720) 865-8408 


Target date to complete 

implementation activities 

(Generally expected 

within 60 to 90 days) 
June 30, 2020 


Agree or Disagree with 
Recommendation 


Agree 


Narrative for Recommendation 2.8 

The Public Trustee’s Office recognizes the value of segregating duties. We will discuss 
the feasibility of this recommendation with the Controller’s Office by June 30, 2019. 
Should it be feasible to implement this recommendation, we will work with the 
Controller’s Office to develop a plan to implement this recommendation by December 
31, 2019. 


RECOMMENDATION 2.9 
Update Bank Reconciliation Form — Until Recommendation 2.8 can be implemented, 
the Denver Public Trustee should immediately update its bank reconciliation form to 
distinguish between outstanding checks and held checks and account for both held 
checks and outstanding checks in accordance with Governmental Accounting 
Standards Board guidance. 


Name and phone number 
of specific point of 
contact for 
implementation 


John Davies 
720-865-2677 
Narrative for Recommendation 2.9 


We agree with this recommendation. The Public Trustee’s Office as if December 31, 
2018 has eliminated the need to distinguish between held and outstanding checks per our 
response to 2.7. 


Target date to complete 
implementation activities 
(Generally expected 
within 60 to 90 days 

December 31, 2018 


Agree or Disagree with 
A Recommendation 


Agree 


L 


Page 35 | Timothy M. O'Brien, CPA | M. O’Brien, CPA 


Denver Auditor 


RECOMMENDATION 2.10 
Obtain and Review Service Organization Controls Reports — The Denver Public 
Trustee should work with third-party vendors that provide critical services to obtain 
Service Organization Controls reports from them by the end of 2019. These reports 
should be carefully reviewed to determine if there are any weaknesses or gaps in the 
controls provided by the vendor and to identify critical “user controls” the Denver 


Public Trustee needs to have in place to rely on the vendor’s controls. 
| Target date to complete | Name and phone number 


Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
within 60 to 90 days) _ implementation | 
Agree December 31, 2019 Sara Harmer 


720-913-4820 l 


L 


Narrative for Recommendation 2.10 

We agree with this recommendation. The Public Trustee’s Office sees the value in 
ensuring that a vendor’s software performs the tasks we need it to without error, and that 
no errors are introduced into its processes when an update to the software is performed. 
The Public Trustee’s Office will continue to attempt to obtain SOC reports from existing 
vendors and if we obtain them, will work with Technology Services to implement a plan 
to review them. 


| RECOMMENDATION 2.11 

Develop and Implement Policies and Procedures for Service Organizations — The 
Denver Public Trustee should develop and implement formal written policies and 
procedures for monitoring its third-party vendors that provide critical services but that 
do not have Service Organization Controls reports available by the end of 2019. These 
policies and procedures should address all critical requirements that would otherwise 
be addressed in a standard Service Organization Controls report. 

Target date to complete | Name and phone number 


Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
within 60 to 90 days implementation 
Agree December 31, 2019 Sara Harmer 


720-913-4820 


Narrative for Recommendation 2.11 

We agree with this recommendation. For vendors from whom SOC reports are not 
available, the Public Trustee’s Office will commit to having a discussion with 
Technology Services about the feasibility of developing a written policy/procedure 
document that addresses all critical requirements that would otherwise be in a standard 
SOC report. 
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RECOMMENDATION 2.12 
Strengthen Segregation of Duties -The Denver Public Trustee should improve 
segregation of duties by conducting and documenting a thorough review of the current 
duties assigned to its staff, including identifying incompatible job responsibilities by 
the end of 2019. The Denver Public Trustee should then remove some incompatible 
duties from personnel with excessive responsibilities and move those responsibilities to 
other personnel. For example, a single employee should not have the authority to create 
and submit the positive pay file as well as have the responsibility to approve or reject 
positive pay exceptions. l 


Target date to complete 
Agree or Disagree with | implementation activities 
Recommendation (Generally expected 


Name and phone number 
of specific point of 
contact for 


Narrative for Recommendation 2.12 

We agree with this recommendation. The Public Trustee’s accounting team is comprised 
of two people and as with any small accounting team, any changes in staff can increase 
the challenges we face when it comes to the separation of duties. We will re-evaluate the 
current processes and responsibilities for each employee and segregate responsibilities as 
much as possible using other Public Trustee staff where possible. For the areas where 
segregation is more difficult, we will implement more management oversight and create a 
process to document that these checks and balances are taking place. In regards to the 
Positive Pay example, although it appeared that there was only one employee involved in 
the process, there are other employees who also receive the exception emails directly 
from the bank. The process when such an event occurs is to respond via email to the 
other employees on the decision to pay or reject and why. We believe we can improve 
processes like this as well as other internal controls by providing them in written form by 
December 31, 2019. 
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RECOMMENDATION 2.13 

Delegate Authority for User Permissions — To better segregate duties, the Denver 
Public Trustee should, by the end of 2019, assign the ability for modifying user 
permissions to someone who does not have other responsibilities in Benchmark. 


Target date to complete | Name and phone number 
Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 


within 60 to 90 days 
Agree June 30, 2019 John Davies 
720-865-2677 


Narrative for Recommendation 2.13 

We agree with this recommendation. The Public Trustee’s Office acknowledges there is 
a deficiency within the segregation of duties regarding user permissions with its 
benchmark tool. However, we are concerned that to comply with this recommendation 
will require intervention from our vendor, Benchmark. We will commit to discussing the 
opportunity with our vendor by June 30, 2019 to determine the feasibility of making this 
change. 


RECOMMENDATION 2.14 
Implement Timely Removal of Access — The Denver Public Trustee should 
immediately create and implement formal written policies and procedures for the 
timely removal of access for terminated or transferred employees. 

Target date to complete | Name and phone number 


Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
within 60 to 90 days) implementation 
Agree December 31, 2019 John Davies 
720-865-2677 


Narrative for Recommendation 2.14 

We agree with this recommendation. The Public Trustee’s Office will work with the 
Clerk and Recorder agency’s program staff to include benchmark in their new 
hire/terminated employee process by December 31, 2019. 
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RECOMMENDATION 2.15 l 
Develop Review Process for User Permissions — The Denver Public Trustee should 


create and implement formal written policies and procedures to periodically review 
user permissions to ensure all users have appropriate access to Denver Public Trustee 
information systems and that there are no unauthorized users with access to the 
information systems by the end of 2019. 


Target date to complete | Name and phone number 
Agree or Disagree with | implementation activities of specific point of 
Recommendation (Generally expected contact for 
within 60 to 90 days) implementation 
Agree See Recommendation 2.1 John Davies 
720-865-2677 


Narrative for Recommendation 2.15 

We agree with this recommendation. The Public Trustee’s Office will commit to 
generating a formal written policy for periodically reviewing User Permissions within 
benchmark and will enact the policy in accordance with recommendation 2.1. 


Please contact John Davies at 720-865-2677 with any questions. 


Sincerely, 
aan i 
WY l 
John Davies 
Chief Deputy Public Trustee 


cc: Valerie Walling, Deputy Auditor, CPA, CMC® 
Jeremy Creamean, CPA, Audit Supervisor 
Kevin Sear, CPA, CIA, CISA, CFE, CGMA, Audit Manager 
Debra Johnson, Clerk and Recorder 
Juan Guzman, Deputy Clerk and Recorder 
Beth Machann, Controller 
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OBJECTIVE 


The objective of the audit was to review the Denver Public Trustee—including its accounting practices, 
compliance with laws and regulations, and governance structure—and to evaluate the efficiency and 
effectiveness of its internal controls over the financial reporting and foreclosure process. 


SCOPE 


The scope of the audit included all Denver Public Trustee financial transactions between January 1, 
2017, and December 31, 2018, including, but not limited to foreclosure filings, outside auction sales, 
cures, and redemptions. The scope of the audit did not include the transfer of titles. 


METHODOLOGY 


We used several methodologies to gather and analyze information related to the audit objective, 
including but not limited to: 
e Interviewing the following individuals: 
o Leadership and management of the Denver Public Trustee and 
o Key members of the Denver Public Trustee staff. 


e Reviewing the following criteria: 


o City ordinances and state laws, including Colorado Revised Statutes, the Denver Charter, 
and the Denver Revised Municipal Code; 


o The Denver Public Trustee’s internal policies and procedures; and 
o City and County of Denver Fiscal Accountability Rules. 
e Conducting observations of key processes, including the creation of foreclosure case files, cash 
receipts, cash-handling, cash disbursements, and reconciliations. 
e Analyzing the following: 
o The Mayor’s budget books for 2017-2019; 
o Bank account activity and balances; 


o Data obtained from the Denver Public Trustee's foreclosure case management system, 
Benchmark, and its online auction system, RealAuction; and 


o Financial information obtained from the City’s system of record, Workday. 


e Testing the following: 


o Third-party confirmation of a statistical sample of unclaimed property remitted to the state's 
Great Colorado Payback Program; 
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o Payroll approvals; 
o Third-party confirmation of the Denver Public Trustee's bank balances; and 


o The Denver Public Trustee's information technology general controls, including Service 
Organization Controls reports. 
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APPENDICES 
Appendix A - Glossary 


Agency fund - Agency funds are a type of fiduciary fund and are generally used to account for assets 
the City holds on behalf of others as their agent.8 


Benchmark - The information system used by the Denver Public Trustee for tracking the foreclosure 
process, tracking payments to and from stakeholders, and maintaining the record of events in a 
foreclosure. 


Control deficiency — A deficiency in internal control over financial reporting exists when the design or 
operation of a control does not allow management or employees, in the normal course of performing 
their assigned functions, to prevent, or detect and correct, misstatements on a timely basis.*4 


Cure - Absent a renegotiation of the loan between the lender and borrower, the borrower may stop 
the foreclosure process by “curing” the default. This means the borrower may bring the loan up to date 
by paying the outstanding loan default.” 


Fiduciary fund — Fiduciary funds are trust and agency funds that account for assets held by a 
governmental unit in a trustee capacity or as an agent for individuals, private organizations, other 
governmental units, or other funds. These include expendable trust funds, nonexpendable trust funds, 
pension trust funds, and agency funds. 


Lien holder — A creditor or party who holds a mortgage or a legally enforceable right (lien) on a specific 
asset, good, or property of another as security for a debt.? An example would be a bank that holds the 
mortgage on a house. 


Significant weakness — A deficiency, or a combination of deficiencies, in internal control, such that there 
is a reasonable possibility that a significant misstatement of the entity’s financial statements or processes 
will not be prevented, or detected and corrected, on a timely basis. 


Positive pay — A service provided by a bank that helps protect against fraudulent check activity. After a 
check is issued, the issuer provides the check information to the bank. Prior to processing the check, the 
bank uses this information to verify that the check is valid and approved. If discrepancies are detected, 
the bank stops processing the check and notifies the issuer of the discrepancy. 


33 City and County of Denver, 2017 Comprehensive Annual Financial Report (Denver, Colorado: December 31, 2017). https://www. 
denvergov.org/content/dam/denvergov/Portals/344/documents/CAFR/Report_CAFR_2017.pdf. 


34 American Institute of Certified Public Accountants, AU-C § 265.04, Communicating Internal Control Related Matters Identified 
in an Audit (2018). Accessed February 6, 2019, https://www.aicpa.org/content/dam/aicpa/research/standards/auditattest/ 
downloadabledocuments/au-c-00265.pdf. 


35 “Foreclosure Information,” City and County of Denver, Office of the Clerk and Recorder, accessed January 15, 2019, https://www. 
denvergov.org/content/denvergov/en/denver-office-of-the-clerk-and-recorder/foreclosures/foreclosure-information.html. 


36 City and County of Denver, 2017 Comprehensive Annual Financial Report (Denver, Colorado: December 31, 2017). https://www. 
denvergov.org/content/dam/denvergov/Portals/344/documents/CAFR/Report_CAFR_2017.pdf. 


37 “lienholder,” BusinessDictionary, accessed January 18, 2019, http://www.businessdictionary.com/definition/lienholder.html. 
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Redemption — After a foreclosed property has been sold at auction, the junior lien holders have an 
opportunity to purchase the foreclosed property at the auction sale price before their liens are stripped 
from the property. 


Workday - The City’s authorized data system of document storage. Among other purposes, Workday is 
used to record and manage financial data, as well as to store supporting documentation for financial 
transactions. 


38 “Foreclosure Information,” City and County of Denver, Office of the Clerk and Recorder, accessed January 15, 2019, https://www. 
denvergov.org/content/denvergov/en/denver-office-of-the-clerk-and-recorder/foreclosures/foreclosure-information.html. 
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Office of the Auditor 


The Auditor of the City and County of Denver is independently elected by the citizens of 
Denver. He is responsible for examining and evaluating the operations of City agencies and 
contractors for the purpose of ensuring the proper and efficient use of City resources. He also 
provides other audit services and information to City Council, the Mayor, and the public to 
improve all aspects of Denver's government. 


The Audit Committee is chaired by the Auditor and consists of seven members. The Audit 
Committee assists the Auditor in his oversight responsibilities regarding the integrity of the 

City’s finances and operations, including the reliability of the City’s financial statements. The 
Audit Committee is structured in a manner that ensures the independent oversight of City 
operations, thereby enhancing citizen confidence and avoiding any appearance of a conflict 
of interest. 


201 West Colfax Avenue, #705 
Denver CO, 80202 
(720) 913-5000 + Fax (720) 913-5253 


www.denverauditor.org 


Our Mission 


We deliver independent, transparent, and professional oversight in order to safeguard and 
improve the public’s investment in the City of Denver. Our work is performed on behalf of 
everyone who cares about the City, including its residents, workers, and decision-makers. 


